XIQ OnPrem / IQVA New Release

[daniel1]

Hi,

can anyone from Extreme tell me, when you plan to release a new feature version of XIQ OnPrem?

This is getting ridiculous, no big feature update for one and half year, we still have to use 21.1.x, so January 2021 version according to your scheme.

[BillL · Accepted solution]

Hello,

Allow me to simplify.  As the bulletin says, "In certain configurations, an attacker could execute arbitrary commands with the privileges of the script."  In IQVA, yes, c_rehash is present. However, IQVA does not use it in any process, the configurations required for exploit are non-existent, and access to the OS in any capacity to expose it is not exposed.   Several other CVE's are being tackled in the January release, specifically CVE-2021-4034.   And no, the January release is not a joke, and is currently tracking as follows:

• Dev Start:  (after 22r7 in cloud). on or about 11/15
• Dev Complete:  12/15 (4w development time)
• QA Test: 3w beginning in early January
• GA Available:  end of January

[daniel1]

It's unfortunate to hear that Extreme presents their OnPrem customers a "Go to Cloud or die" choice.

[juergen_dannewi]

The update is available now
Download: hivemanager-ng-upgrade-pack-21.1.23.4-IQVA-2023-02-16.tar.signed | Extreme Portal (force.c...

[BillL]

While IQVA has been announced EOS, we are planning on a release of IQVA in the Dec/January timeframe.  It will feature several bug fixes, updated features, support for DTLS 1.2, and new AP support for the new "-1" SKU's (no bluetooth). 

[daniel1]

Hi @BillL ,
are you guys serious with this? Security Advisory: SA-2022-010 – OpenSSL (CVE-2022-1292) | Extreme Portal (force.com)
"IQVA – Will not be fixed. Please upgrade to XIQ."

I'm guessing that your "Dec/Jan release" was just a joke?